Legal
Sub-processors
To deliver our service we engage a small number of carefully selected sub-processors. This page is the canonical, current list — our customers can rely on it for their own GDPR transparency obligations toward guests.
Last updated · May 19, 2026
How it works
legame is in most cases a processor (GDPR Art. 28) on behalf of our customers — we host and run the website, but the customer (the restaurant operator) is the controller for guest data (reservations, contact messages).
The parties below are sub-processors: they receive personal data from us to make the service technically possible (hosting, email, storage, error tracking, payment processing).
Our processing agreement with each sub-processor enforces the same GDPR safeguards we maintain toward our customers.
Current list
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Clerk Inc. | Authentication, user management | USA | SCCs (2021/914), DPA |
| Vercel Inc. | Hosting, edge functions, deployment | USA / EU edge | SCCs, DPA |
| Resend Inc. | Transactional email (verification, reservation confirmation, support replies) | USA / EU | SCCs, DPA |
| Cloudflare Inc. | CDN, R2 storage (photos, ZIP exports), Turnstile bot protection | USA / global | SCCs, DPA |
| Functional Software Inc. (Sentry) | Error reporting, performance monitoring | USA / EU | SCCs, DPA |
| Spline Inc. | 3D asset CDN (no personal data, scene files only) | USA | Public hosting, no personal data |
| {TBD: Mollie B.V. or Stripe Inc.} | Subscription payment processing | NL (Mollie) / IE+USA (Stripe) | DPA (Mollie within EU), SCCs with Stripe |
| {TBD: Plausible / Vercel Analytics / in-house} | Visitor analytics for legame.nl and customer sites (Standard+, Premium) | EU (Plausible) / EU+USA (Vercel) | DPA + SCCs where applicable |
Transfers outside the EEA happen exclusively under Standard Contractual Clauses (Module 2 or 3) or an adequacy decision (where applicable).
Changes to this list
When we add a new sub-processor or change an existing one, we notify active customers at least 30 days in advance by email. If you as a customer object: let us know and we will look for a workable alternative together. If none can be found, you can cancel free of charge before the change takes effect.